System and Method for Client-Server-Based Wireless Intrusion Detection

1. A method for detecting unauthorized use of a wireless local area network having at least one mobile unit that communicates with at least one access point, comprising: accumulating first network traffic data at a mobile unit; accumulating second network traffic data at an access point; communicating said first and second traffic data to a computer; and correlating said first and second traffic data in said computer to identify non-correlated traffic data indicative of unauthorized use of the wireless local network and signaling an alarm condition when said non-correlated traffic data exceeds a threshold portion of said traffic data.

2. A method as specified in claim 1 wherein said first traffic data includes number of transmitted messages for said mobile unit.

3. A method as specified in claim 2 wherein said first traffic data includes destination address of said transmitted messages.

4. A method as specified in claim 1 wherein said first traffic data includes number of received messages for said mobile unit.

5. A method as specified in claim 4 wherein said first traffic data includes source address of said received messages.

6. A method as specified in claim 1 wherein said first traffic data includes a record of association requests of said mobile unit with said access point.

7. A method as specified in claim 1 wherein said first traffic data includes a record of disassociation transactions.

8. A method as specified in claim 1 wherein said first traffic data includes number of broadcast and multicast frames received by said mobile unit.

9. A method as specified in claim 1 wherein said first traffic data includes a record of authentication requests.

10. A method as specified in claim 1 wherein said second traffic data includes number of transmitted messages for said access point.

11. A method as specified in claim 10 wherein said second traffic data includes destination address of said transmitted messages.

12. A method as specified in claim 1 wherein said second traffic data includes number of received messages for said access point.

13. A method as specified in claim 10 wherein said second traffic data includes source address of said received messages.

14. A method as specified in claim 1 wherein said second traffic data includes a record of association requests of mobile units with said access point.

15. A method as specified in claim 1 wherein said second traffic data includes a record of disassociation transactions.

16. A method as specified in claim 1 wherein said second traffic data includes number of broadcast and multicast frames sent by said access point.

17. A method as specified in claim 1 wherein said second traffic data includes a record of authentication requests.

18. A method as specified in claim 1 wherein said communicating said traffic data to a computer is repeated on a periodic basis.

19. A method as specified in claim 1 wherein said communicating said traffic data to a computer is in response to a command signal from said computer.

20. A method for detecting unauthorized use of a wireless local area network having at least two mobile units that communicate with at least one access point, comprising: accumulating first network traffic data at a first mobile unit; accumulating second network traffic data at a second mobile unit; communicating said first and second traffic data to a computer; and correlating said first and second traffic data in said computer to identify non-correlated traffic data indicative of unauthorized use of the wireless local network and signaling an alarm condition when said non-correlated traffic data exceeds a threshold portion of said traffic data.

21. A system for detecting unauthorized use of a wireless local area network, comprising: at least one mobile unit; at least one access point; and at least one server computer, wherein first network traffic data is accumulated by said at least one mobile unit, second network traffic data is accumulated by said at least one access point, said first and second network traffic data are communicated to said at least one server computer, said first and second network traffic data are correlated by said at least one server computer to identify non-correlated traffic data indicative of unauthorized use of the wireless local area network, and an alarm condition is signaled when said non-correlated traffic data exceeds a threshold.